topic Re: Access rule on SMB doesn't work in Spark Firewall (SMB)

Access rule on SMB doesn't work

engineer-a — Wed, 02 Aug 2023 06:17:55 GMT

Hi, guys!

The custmer has faced an issue with Access rule for "File storage and sharing" - it doesn't work at all for group Poligraphy - Rule #1 in access rules, and traffic goes by rule #8 and dropped.

But similar rules for other groups and categories work properly (6, 7 rule)

SSL Inspection is not enabled, as Regulator Inspection is already in use.

Please help me figure out rule 1, what could be the matter?

SG-1600

Firmware has been upgraded to the last one.

Screenshots in the attachments.

Re: Access rule on SMB doesn't work

Chris_Atkinson — Wed, 02 Aug 2023 06:54:18 GMT

How is the source defined and what is an example destination they're attempting to access?

Re: Access rule on SMB doesn't work

engineer-a — Thu, 03 Aug 2023 04:49:08 GMT

Hi Chris,

As shown in screenshot 4, the source is defined as a AD group (by the way, the names and surnames of users in AD are defined in russian, not in latin, so in the logs on screenshot 2 you can see in the User column instead of their names and surnames - questions and strange characters),

And as the destination is indicated "File storage and sharing" category.

So the traffic goes through 8th Rule, although must go by 1

Re: Access rule on SMB doesn't work

engineer-a — Thu, 03 Aug 2023 04:55:42 GMT

That is, automatic rule number 8, that drops drops Undesirable applications does not allow making exceptions by adding allowing rules from above (for example, for file storages and not only)